Saying "whole screenfuls of data at a time" was me simplifying things for the benefit of the uninitiated. In terms of what actually happens (from what I understand), the 3270 controller sends the host an interrupt to say some terminal has data ready. When the host gets around to it – on a busy mainframe system with thousands of terminals, the interrupt would be queued while the host had finished processing data from other terminals – the host would send the controller either a READ BUFFER command (which would send the host the entire contents of the screen) or a READ MODIFIED command (which would only send the modified fields). Most 3270 apps would define fields on the screen using START FIELD (SF) special characters, which is essentially what you mean by "protect mode protocol" (3270E added START FIELD EXTENDED, SFE, which allowed you to do fancier things like change the text colour, or define a field as numeric only, so the terminal would not allow alphabetic characters to be input into it), and then read only the modified fields back using READ MODIFIED. I believe READ BUFFER was mainly used for legacy applications which were written prior to the invention of READ MODIFIED (in particular applications originally written for the 3270's 1960s predecessor, the IBM 2260, which didn't have any such concept.)